Learn how easy is to bypass firewalls using DNS tunneling (and also how to block it)
Tags
attack-pattern: Data Direct Dns - T1071.004 Dns - T1590.002 Dns Server - T1583.002 Dns Server - T1584.002 Domains - T1583.001 Domains - T1584.001 Server - T1583.004 Server - T1584.004 Ssh - T1021.004 Tool - T1588.002 Connection Proxy - T1090 Sudo - T1169
Show in Graph
Common Information
Type Value
UUID 5e4ef68f-bad5-4208-8c50-ba2944e0c0ce
Fingerprint a5b8d1d0613076d7
Analysis status DONE
Considered CTI value 0
Text language
Published Nov. 8, 2018, 9:22 p.m.
Added to db Sept. 26, 2022, 9:31 a.m.
Last updated Nov. 19, 2024, 9:51 p.m.
Headline Learn how easy is to bypass firewalls using DNS tunneling (and also how to block it)
Title Learn how easy is to bypass firewalls using DNS tunneling (and also how to block it)
Detected Hints/Tags/Attributes 46/1/12
Source URLs
Redirection Url
Details Source https://medium.com/@galolbardes/learn-how-easy-is-to-bypass-firewalls-using-dns-tunneling-and-also-how-to-block-it-3ed652f4a000
URL Provider
Details Provider Source level domain
Details medium.com medium.com
Attributes
Details Type #Events CTI Value
Details Domain 838 
example.com
Details Domain 2 
server1.example.com
Details Domain 1 
server2.example.com
Details Domain 1 
mypieceofdata.server1.example.com
Details Domain 1 
dnsa.exampledomain.xyz
Details Domain 1 
exampledomain.xyz
Details Domain 3 
code.kryo.se
Details File 44 
readme.html
Details IPv4 1 
12.34.52.67
Details IPv4 97 
10.0.0.1
Details IPv4 198 
1.1.1.1
Details Url 1 
https://code.kryo.se/iodine/check-it